[dependabot]

Bumps weasyprint from 68.0 to 70.0.

Release notes

Sourced from weasyprint's releases.

v70.0

Read about this release on our blog.

This is a security update (CVE-2026-55073, GHSA-r543-q48m-4c9j).

We strongly recommend to upgrade WeasyPrint to the latest version if you: * embed untrusted images, or * rely on the URL fetcher to filter metadata or stylesheets passed as Python parameters.

Security

• Don’t render EPS images.
• Always use original URL fetcher when available.

Features

• #2905: Add initial support of CSS Notes, with financial support from NLnet
• #2731, #2781: Log an error on unknown render and write_pdf options
• #2802, #2805: Create immutable releases on GitHub
• #2809, #2810: Switch to MSYS2 UCRT64 environment for Windows tests and executables
• #2777, #2814: Support COLR emoji fonts
• #2667, #2744: Support context paint in SVG markers
• #1862, #2844: Improve filename detection for attachments
• #2816, #2827: Set SVG title as alternative text
• #2718: Provide a 'onedir' Windows executable
• #2863: Support box-shadow
• #2755: Support RTL SVG text anchoring
• #2866: Don’t use f-strings in logs

Bug fixes

• #2799: Keep HarfBuzz font faces alive during PDF subsetting
• #2764, #2793: Accept Path as base URL in CSS
• #2800, #2801: Fix position of raster emojis
• #2782, #2807: Use POSIX paths in Fontconfig
• #2766, #2779: Use response bytes when image file path doesn’t exist
• #2277, #2728: Honor page breaks on floated elements
• #2789, #2818: Use base URL when solving pending properties
• #2820: Ignore unresolvable math in image slices
• #2901, #2825: Transform SVG size into CSS to apply CSS sizing algorithm
• #2819: Resolve calc() division by zero to infinity
• #2824: Remove old deprecation warnings
• #2762, #2780: Set SVG gradient color before path construction
• #2761: Handle split tables with captions
• #2215, #2747: Discard broken at-rules
• #2736, #2738: Apply transformations to SVG opacity groups
• #2830: Use a stack to draw simple borders
• #2831: Fix line_height() crash on calc() values
• #2784, #2832: Set fallback font for Unicode test
• #2726, #2881: Improve accessibility of PDF forms
• #2803: Fix inline width after backtracked line breaks
• #2833: Store root style in anonymous style

... (truncated)

Changelog

Sourced from weasyprint's changelog.

Version 70.0

Released on 2026-09-08.

This is a security update (CVE-2026-55073, GHSA-r543-q48m-4c9j).

We strongly recommend to upgrade WeasyPrint to the latest version if you:

• embed untrusted images, or
• rely on the URL fetcher to filter metadata or stylesheets passed as Python parameters.

Security:

• Don’t render EPS images.
• Always use original URL fetcher when available.

Features:

• [#2905](https://github.com/Kozea/WeasyPrint/issues/2905) <https://github.com/Kozea/WeasyPrint/pull/2905>_: Add initial support of CSS Notes, with financial support from NLnet
• [#2731](https://github.com/Kozea/WeasyPrint/issues/2731) <https://github.com/Kozea/WeasyPrint/issues/2731>, [#2781](https://github.com/Kozea/WeasyPrint/issues/2781) <https://github.com/Kozea/WeasyPrint/pull/2781>: Log an error on unknown render and write_pdf options
• [#2802](https://github.com/Kozea/WeasyPrint/issues/2802) <https://github.com/Kozea/WeasyPrint/issues/2802>, [#2805](https://github.com/Kozea/WeasyPrint/issues/2805) <https://github.com/Kozea/WeasyPrint/pull/2805>: Create immutable releases on GitHub
• [#2809](https://github.com/Kozea/WeasyPrint/issues/2809) <https://github.com/Kozea/WeasyPrint/issues/2809>, [#2810](https://github.com/Kozea/WeasyPrint/issues/2810) <https://github.com/Kozea/WeasyPrint/pull/2810>: Switch to MSYS2 UCRT64 environment for Windows tests and executables
• [#2777](https://github.com/Kozea/WeasyPrint/issues/2777) <https://github.com/Kozea/WeasyPrint/issues/2777>, [#2814](https://github.com/Kozea/WeasyPrint/issues/2814) <https://github.com/Kozea/WeasyPrint/pull/2814>: Support COLR emoji fonts
• [#2667](https://github.com/Kozea/WeasyPrint/issues/2667) <https://github.com/Kozea/WeasyPrint/issues/2667>, [#2744](https://github.com/Kozea/WeasyPrint/issues/2744) <https://github.com/Kozea/WeasyPrint/pull/2744>: Support context paint in SVG markers
• [#1862](https://github.com/Kozea/WeasyPrint/issues/1862) <https://github.com/Kozea/WeasyPrint/issues/1862>, [#2844](https://github.com/Kozea/WeasyPrint/issues/2844) <https://github.com/Kozea/WeasyPrint/pull/2844>: Improve filename detection for attachments
• [#2816](https://github.com/Kozea/WeasyPrint/issues/2816) <https://github.com/Kozea/WeasyPrint/issues/2816>, [#2827](https://github.com/Kozea/WeasyPrint/issues/2827) <https://github.com/Kozea/WeasyPrint/pull/2827>: Set SVG title as alternative text
• [#2718](https://github.com/Kozea/WeasyPrint/issues/2718) <https://github.com/Kozea/WeasyPrint/issues/2718>_: Provide a 'onedir' Windows executable
• [#2863](https://github.com/Kozea/WeasyPrint/issues/2863) <https://github.com/Kozea/WeasyPrint/pull/2863>_: Support box-shadow
• [#2755](https://github.com/Kozea/WeasyPrint/issues/2755) <https://github.com/Kozea/WeasyPrint/pull/2755>_: Support RTL SVG text anchoring
• [#2866](https://github.com/Kozea/WeasyPrint/issues/2866) <https://github.com/Kozea/WeasyPrint/issues/2866>_: Don’t use f-strings in logs

... (truncated)

Commits

• 4d3b7b6 Version 70.0
• 289e278 Always use original URL fetcher when available
• aeb3be7 Merge remote-tracking branch 'security/main'
• 4835724 Merge pull request #2915 from havelaer/fix-nested-svg-viewport-restore
• 0331051 Restore nested SVG viewport size on the SVG object, not the drawing function
• e4b8b45 Add harfbuzz-vector requirement for Fedora
• 371e4de Merge pull request #2905 from Kozea/notes
• 590bf63 Merge pull request #2913 from Kozea/fast-svg-paths
• f6570c3 Use a faster regex-based parser for SVG paths
• bc05162 Use faster deque for SVG vertices
• Additional commits viewable in compare view